sublimemediumRule

Link: Free file host links from suspicious support sender with credential theft language

Detects inbound messages from senders using the local part 'support' that contain a small number of links pointing exclusively to free file hosting services. The message contains NLU signals indicate credential theft intent related to file sharing or cloud services.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

initial-access

Detection Query

type.inbound
and sender.email.local_part == 'support'
and 1 < length(filter(body.current_thread.links,
                      not regex.icontains(.href_url.url,
                                          '\.(pdf|doc|docx|csv|xls|xlsx|ppt|pptx)'
                      )
               )
) <= 5
and all(body.current_thread.links,
        .href_url.domain.root_domain in $free_file_hosts
        or .href_url.domain.domain in $free_file_hosts
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == 'cred_theft' and .confidence != 'low'
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == 'File Sharing and Cloud Services' and .confidence != 'low'
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: Free file host links from suspicious support sender with credential theft language"
description: "Detects inbound messages from senders using the local part 'support' that contain a small number of links pointing exclusively to free file hosting services. The message contains NLU signals indicate credential theft intent related to file sharing or cloud services."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and sender.email.local_part == 'support'
  and 1 < length(filter(body.current_thread.links,
                        not regex.icontains(.href_url.url,
                                            '\.(pdf|doc|docx|csv|xls|xlsx|ppt|pptx)'
                        )
                 )
  ) <= 5
  and all(body.current_thread.links,
          .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.domain in $free_file_hosts
  )
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == 'cred_theft' and .confidence != 'low'
  )
  and any(ml.nlu_classifier(body.current_thread.text).topics,
          .name == 'File Sharing and Cloud Services' and .confidence != 'low'
  )
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Free file host"
  - "Social engineering"
detection_methods:
  - "Sender analysis"
  - "URL analysis"
  - "Natural Language Understanding"
id: "816ad5de-e97c-5d8d-93bf-d0ed100d5607"